← CVE Intelligence

CVE-2026-2603

Keycloak: keycloak: unauthorized authentication via disabled saml identity provider PUBLISHED

Description (CNA)

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2.14-1 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-16 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-16 before *
Red Hat / Red Hat build of Keycloak 26.2.14unaffected
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4.10-1 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-12 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-12 before *
Red Hat / Red Hat build of Keycloak 26.4.10unaffected

CWE

CWE-306

References

ADP enrichment

CISA-ADP

No English description supplied.

redhat-SADP

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.